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Dear Max and Marc: 


Please accept this supplemental disclosure under Fed. R. Evid. 702, 703, and 705, and 
Fed. R. Crim. P. 16(a)(1)(G). As we previously disclosed, many of the witnesses below will 
testify primarily as fact witnesses, but may possess special skills, training, or knowledge that will 
assist the jury in understanding some of the evidence in the case. To the extent these witnesses’ 
testimony (or aspects of it) could be considered expert testimony under Rule 702, the 
government is supplementing its prior notice with information required by Fed. R. Crim. P. 
16(a)(1)(G)(i11): (1) a complete statement of all opinions that the government will elicit from the 
witness in its case-in-chief; (2) the bases and the reasons for them; (3) the witness’ qualifications, 
including a list of all publications authored in the previous 10 years; and (4) a list of all other 
cases in which, during the previous 4 years, the witness has testified as an expert at trial or by 
deposition. 


Vincent Kenney, Senior Computer Scientist, Federal Bureau of Investigation 


The government intends to call FBI Computer Scientist Vincent Kenney to testify 
concerning virtual currency and blockchain analysis. As reflected in the report that we produced 
to you on August 17, 2022, Mr. Kenney will opine concerning cryptocurrency transactions used 
to lease domains from Namecheap that were used in furtherance of unauthorized access to the 


filing agent victim, Faas . 


We produced Mr. Kenney’s CV to you on August 17, 2022. He has served in the FBI’s 
Salt Lake City Field Office since 2019. He is the Lead Computer Scientist and technical advisor 
there. He is a member of the FBI’s Virtual Currency Response Team (“VCRT’”), which is a 
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nationwide team of cryptocurrency and virtual currency experts. The VCRT, among other 
things, uses blockchain analytics to identify fraud and money laundering activities involving 
cryptocurrencies, provides FBI and external training, and develops python scripts and 
applications around automated blockchain analysis. Mr. Kenney was recently recognized by the 
Assistant Director of the FBI’s Criminal Investigations Division for cryptocurrency expertise. 
He possesses skills in blockchain analysis and threat intelligence platforms, to include but not 
limited to, Chainalysis Reactor, TRM Labs, Coinbase Analytics, and Wallet Explorer. He also 
possesses skills in analysis of various technical aspects of blockchain technologies, such as smart 
contracts, blockchain mining, and blockchain security. 


Before joining the FBI, he worked at Boeing as a software engineer (2013 to 2015) and at 
SPARTA Inc. as a Software Development Intern (summers 2011 and 2012). Mr. Kenney holds a 
Bachelor of Science in Computer Science from Saint Vincent College in Latrobe, Pennsylvania. 
He has received SANS cyber security trainings in Blockchain and Smart Contract Security, 
Reverse-Engineering Malware, Memory Forensics-In Depth, and Advance Incident Response, 
Threat Hunting, and Digital Forensics. 


He has no publications in the last ten years. In approximately June 2022, Mr. Kenney 
testified as an expert in cryptocurrency and blockchain analysis in a criminal case, United States 
v. Paige Thompson, CR19-159-RSL, in the Western District of Washington. 


Through his testimony, Mr. Kenney is expected to explain bitcoin, including how bitcoin 
transactions are conducted, and how transactions can be traced on the blockchain. Mr. Kenney 
will explain the structure of a bitcoin transaction and will define and explain terms and concepts 
such as bitcoin addresses, private keys, and wallets. Mr. Kenney will testify as to what 
information is recorded on the bitcoin blockchain and how that blockchain is stored and updated. 
Mr. Kenney will explain the function of virtual currency exchanges and payment processors, 
including BitPay, and will explain how bitcoin can be used to pay for products and services. He 
will explain what information virtual currency payment processors collect, including transaction 
hashes, Bitcoin addresses, transaction times, merchant names, buyer emails, and Internet 
Protocol addresses associated with transactions, and will testify regarding the importance of that 
information. 


Mr. Kenney is expected to testify regarding how cryptocurrency wallet software works, 
and regarding concepts that include unspent transaction output, change addresses, and peel 
chains. He will also explain how these concepts can be used to demonstrate common control of 
two or more cryptocurrency addresses. He is expected opine that the three Bitpay transactions 
described in his report, used to pay Namecheap, were conducted by an individual or group of 
individuals who jointly controlled the bitcoin used in those transactions. 


I approve this disclosure pursuant to Fed. R. Crim. P. 16(a)(1)(G)(v). 


VINCENT KENNEY 
FBI Computer Scientist 
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Maxwell Clarke, Financial Economist, Securities and Exchange Commission 


The government intends to call Securities and Exchange Commission Financial 
Economist Maxwell Clarke to testify concerning statistical analyses he performed concerning the 
trading of Vladislav Klyushin, Igor Sladkov, Aleksandr Borodaev, Sergey Uryadov, Mikhail 
Irzak, Boris Varshavsky, Nikolai Rumiantcev, and M-13, LLC for the period January 1, 2018 
through September 30, 2020. 


We produced Mr. Clarke’s CV to you on August 17, 2022. Mr. Clarke has no 
publications in the last ten years. In February 2022, he testified in SEC v. Sargent, 19-cv-11416- 
WGY, a civil matter in the District of Massachusetts. 


Mr. Clarke will first summarize the above investors’ trading for this time period, 
including setting forth the trading’s proximity to earnings events, the duration of the trades, the 
association of the trades to financial reporting made through the filing agents ggggor GRE 
BEE. 2nd its overall profitability compared to net deposits into the investors’ accounts. 


For the universe of the above investors’ trades that were opened within three days before 
an earnings event and closed any time after the earnings event—an earnings event meaning the 
public release of a Form 8-K, 10-K, 10-Q, 6-K, 20-F, or 40-F reporting a public company’s 
financial performance—Mr. Clarke analyzed whether or not the investors’ proportion of jggggggor 
SELES RE -Cclated trading was reflective of ggg and gE s approximate overall 
share in the marketplace for the filing of financial reporting. Mr. Clarke concluded through the 
use of a Fisher Exact Test—a statistical test—that the amount of trading around ggg and 
SERESGE -Cclated earnings events was disproportionately high and could not be explained 
by chance alone. 


Mr. Clarke is also expected to testify that he compared the above investors’ pre- 
announcement choice of trading direction (long vs. short, buy vs. sell) against the direction of 
“unexpected earnings outcomes”. (An “unexpected earnings outcome” was defined as a 
situation in which an issuer’s announced financial performance (as measured by earnings per 
share) differed by a threshold amount from market analysts’ published predictions (as reported in 
the Institutional Brokers Estimate System) about those earnings per share). Mr. Clarke used a 
Fisher Exact Test to conclude that chance could not explain the frequency with which the above 
traders consistently predicted unexpected earnings outcomes in their pre-announcement choice of 
trading direction, which occurred, for example, approximately 86 percent of the time in Mr. 
Klyushin’s trades. 


Mr. Clarke is also expected to testify that he analyzed the timing of the above investors’ 
first trades in certain issuers before an earnings event, as it related to the timing of downloads of 
the same issuers’ financial information from ggg. Specifically, he identified the above traders’ 
first transactions in certain ticker symbols where jggggg’s logs revealed that those issuer’s 
financial information had been downloaded before the earnings announcement. Mr. Clarke is 
expected to testify, based on a non-parametric permutation test, that there is a statistical 
relationship between the time of the download and the investors’ first trade; that in nearly all 
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cases, the download preceded the investors’ first trade; and that that relationship cannot be 
explained by chance. 


Mr. Clarke is also expected to testify based on his training and experience analyzing 
market movements as to reasons why financial markets might react differently than expected to a 
positive or negative earnings announcement. These reasons include, among others, the 
difference between an earnings announcement and investors’ views based on the earnings 
announcement of the company’s future prospects; the context of the announcement, which might 
report performance on metrics that are contrary to an earnings per share figure, such as revenue; 
or commentary from executives, which may contain strategic information or announcements not 
found within the earnings per share figure. 


The government will disclose draft summary and other exhibits reflecting Mr. Clarke’s 
analyses and opinions. 


I approve this disclosure pursuant to Fed. R. Crim. P. 16(a)(1)(G)(v). 


Digitally signed by Clarke, 
Maxwell 
Clarke, Maxwell Date: 2022.12.09 13:24:53 


-05'00' 


Maxwell Clarke 
Securities and Exchange Commission 


Erik Uitto, Forensic Examiner, Federal Bureau of Investigation 


The government intends to call Erik Uitto, a forensic examiner and information 
technology specialist who works at the FBI. He will testify concerning his forensic review of 
nine virtual computers that the government obtained by search warrant from Vultr and Digital 
Ocean LLC in or about February 2020—specifically, servers associated with the following IP 
addresses: 206.189.195.244 (www.scoreyourmoney.com); 104.248.76.218 
(www.smartfinancelist.com); 45.77.33.100 (www.appfinreport.info); 45.77.65.69 
(www.financecloudapi.com and www.cloudapifinance.info); 217.69.11.6 
(www.developingcloud.info); 8.9.8.148 (www.finshopland.com); 45.32.171.243 
(www.fnwallinform.info); and 78.141.195.165 (www.shopservice.live); and 104.248.12.148. 


Mr. Uitto has not testified as an expert witness in the last four years. He has not 
published any articles in the last ten years. A copy of his CV is enclosed. We have previously 
produced two copies of his forensic report. We will produce updated copies of his report 
reflecting further review and analysis in advance of his testimony. 


Mr. Uitto will testify based on his knowledge, training, and experience as a forensic 
examiner to the contents, configuration, and use of the virtual servers described above. 
Specifically, he will identify software present on the virtual servers and describe its potential 
uses, including: putty, letsencrypt, nginx, PowerShell Empire, rabtap.exe, and mimikatz, among 
others. He will also describe the contents of logs, including Linux operating system logs and 
PowerShell Empire logs that reflect commands run on or through the servers and/or 
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communications between the servers ame ecacied § He will describe the configuration of 
the virtual servers as part of a reverse proxy network. He will describe IP addresses used to 
access the virtual servers and the presence on the servers of usernames, machine names, IP 
address(es), and domains associated with the filing agent victim, 


I approve this disclosure pursuant to Fed. R. Crim. P. 16(a)(1)(G)(v). 


Digitally signed by ERIK UITTO 
F RI K Ul | | O Date: 2022.12.09 14:58:27 
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Erik Uitto 
Forensic Examiner 
Federal Bureau of Investigation 


Very truly yours, 


RACHAEL S. ROLLINS 
United States Attorney 


By:  /s/Seth B. Kosto 
SETH B. KOSTO 
STEPHEN E. FRANK 
Assistant U.S. Attorneys 


enclosure 


